diff --git a/DEPS b/DEPS
index 1fd824a..2d27484 100644
--- a/DEPS
+++ b/DEPS
@@ -44,7 +44,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': 'b9ce6ed2c025fff19b99bfcd8fe31ffad7ad5288',
+  'v8_revision': '48edec2e2d92c8ede8403f37bed6e3fbc85eb183',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling swarming_client
   # and whatever else without interference from each other.
diff --git a/chrome/app/mash/BUILD.gn b/chrome/app/mash/BUILD.gn
index 981d813..5473d23 100644
--- a/chrome/app/mash/BUILD.gn
+++ b/chrome/app/mash/BUILD.gn
@@ -2,6 +2,7 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
+import("//build/config/nacl/config.gni")
 import("//services/catalog/public/tools/catalog.gni")
 import("//services/service_manager/public/service_manifest.gni")
 
@@ -70,6 +71,13 @@
   if (is_linux && !is_android) {
     packaged_services += [ "//components/font_service:manifest" ]
   }
+
+  if (enable_nacl) {
+    packaged_services += [ "//components/nacl/loader:nacl_loader_manifest" ]
+    if (is_win && target_cpu == "x86") {
+      packaged_services += [ "//components/nacl/broker:nacl_broker_manifest" ]
+    }
+  }
 }
 
 catalog("catalog") {
diff --git a/chrome/browser/chromeos/login/screens/user_selection_screen.cc b/chrome/browser/chromeos/login/screens/user_selection_screen.cc
index 996af007..4b306ea 100644
--- a/chrome/browser/chromeos/login/screens/user_selection_screen.cc
+++ b/chrome/browser/chromeos/login/screens/user_selection_screen.cc
@@ -53,6 +53,7 @@
 const char kKeySignedIn[] = "signedIn";
 const char kKeyCanRemove[] = "canRemove";
 const char kKeyIsOwner[] = "isOwner";
+const char kKeyIsActiveDirectory[] = "isActiveDirectory";
 const char kKeyInitialAuthType[] = "initialAuthType";
 const char kKeyMultiProfilesAllowed[] = "isMultiProfilesAllowed";
 const char kKeyMultiProfilesPolicy[] = "multiProfilesPolicy";
@@ -180,6 +181,7 @@
   user_dict->SetBoolean(kKeyShowPin, CanShowPinForUser(user));
   user_dict->SetBoolean(kKeySignedIn, user->is_logged_in());
   user_dict->SetBoolean(kKeyIsOwner, is_owner);
+  user_dict->SetBoolean(kKeyIsActiveDirectory, user->IsActiveDirectoryUser());
 
   FillMultiProfileUserPrefs(user, user_dict, is_signin_to_add);
   FillKnownUserPrefs(user, user_dict);
diff --git a/chrome/browser/ui/views/infobars/confirm_infobar.cc b/chrome/browser/ui/views/infobars/confirm_infobar.cc
index 810bec2b4..593af47 100644
--- a/chrome/browser/ui/views/infobars/confirm_infobar.cc
+++ b/chrome/browser/ui/views/infobars/confirm_infobar.cc
@@ -18,6 +18,14 @@
 #include "ui/views/controls/button/md_text_button.h"
 #include "ui/views/controls/label.h"
 #include "ui/views/controls/link.h"
+#include "ui/views/layout/layout_constants.h"
+
+namespace {
+
+constexpr int kButtonButtonSpacing = views::kRelatedButtonHSpacing;
+constexpr int kEndOfLabelSpacing = views::kItemLabelSpacing;
+
+}  // namespace
 
 // InfoBarService -------------------------------------------------------------
 
diff --git a/chrome/browser/ui/views/infobars/infobar_view.cc b/chrome/browser/ui/views/infobars/infobar_view.cc
index 5fffc58..fd33301 100644
--- a/chrome/browser/ui/views/infobars/infobar_view.cc
+++ b/chrome/browser/ui/views/infobars/infobar_view.cc
@@ -62,11 +62,6 @@
 
 // InfoBarView ----------------------------------------------------------------
 
-// static
-const int InfoBarView::kButtonButtonSpacing = views::kRelatedButtonHSpacing;
-const int InfoBarView::kEndOfLabelSpacing = views::kItemLabelSpacing;
-const SkColor InfoBarView::kTextColor = GetInfobarTextColor();
-
 InfoBarView::InfoBarView(std::unique_ptr<infobars::InfoBarDelegate> delegate)
     : infobars::InfoBar(std::move(delegate)),
       views::ExternalFocusTracker(this, nullptr),
diff --git a/chrome/browser/ui/views/infobars/infobar_view.h b/chrome/browser/ui/views/infobars/infobar_view.h
index e28491b6..9446621 100644
--- a/chrome/browser/ui/views/infobars/infobar_view.h
+++ b/chrome/browser/ui/views/infobars/infobar_view.h
@@ -38,10 +38,6 @@
  protected:
   typedef std::vector<views::Label*> Labels;
 
-  static const int kButtonButtonSpacing;
-  static const int kEndOfLabelSpacing;
-  static const SkColor kTextColor;
-
   ~InfoBarView() override;
 
   // Creates a label with the appropriate font and color for an infobar.
diff --git a/chromeos/CHROMEOS_LKGM b/chromeos/CHROMEOS_LKGM
index 02f951b8..3f2e6e657 100644
--- a/chromeos/CHROMEOS_LKGM
+++ b/chromeos/CHROMEOS_LKGM
@@ -1 +1 @@
-9233.0.0
\ No newline at end of file
+9236.0.0
\ No newline at end of file
diff --git a/components/ntp_snippets/remote/request_throttler.cc b/components/ntp_snippets/remote/request_throttler.cc
index ae78103..bba80a2 100644
--- a/components/ntp_snippets/remote/request_throttler.cc
+++ b/components/ntp_snippets/remote/request_throttler.cc
@@ -13,6 +13,7 @@
 #include "base/strings/string_split.h"
 #include "base/strings/stringprintf.h"
 #include "base/time/time.h"
+#include "components/ntp_snippets/features.h"
 #include "components/ntp_snippets/ntp_snippets_constants.h"
 #include "components/ntp_snippets/pref_names.h"
 #include "components/prefs/pref_registry_simple.h"
@@ -76,8 +77,8 @@
       type_info_(kRequestTypeInfo[static_cast<int>(type)]) {
   DCHECK(pref_service);
 
-  std::string quota = variations::GetVariationParamValue(
-      ntp_snippets::kStudyName,
+  std::string quota = variations::GetVariationParamValueByFeature(
+      ntp_snippets::kArticleSuggestionsFeature,
       base::StringPrintf("quota_%s", GetRequestTypeName()));
   if (!base::StringToInt(quota, &quota_)) {
     LOG_IF(WARNING, !quota.empty())
@@ -86,8 +87,8 @@
     quota_ = type_info_.default_quota;
   }
 
-  std::string interactive_quota = variations::GetVariationParamValue(
-      ntp_snippets::kStudyName,
+  std::string interactive_quota = variations::GetVariationParamValueByFeature(
+      ntp_snippets::kArticleSuggestionsFeature,
       base::StringPrintf("interactive_quota_%s", GetRequestTypeName()));
   if (!base::StringToInt(interactive_quota, &interactive_quota_)) {
     LOG_IF(WARNING, !interactive_quota.empty())
diff --git a/mash/BUILD.gn b/mash/BUILD.gn
index 142f775..b1e9784f 100644
--- a/mash/BUILD.gn
+++ b/mash/BUILD.gn
@@ -2,6 +2,7 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
+import("//build/config/nacl/config.gni")
 import("//services/catalog/public/tools/catalog.gni")
 import("//services/service_manager/public/service_manifest.gni")
 import("//testing/test.gni")
@@ -73,6 +74,13 @@
   if (is_linux && !is_android) {
     standalone_services += [ "//components/font_service:manifest" ]
   }
+
+  if (enable_nacl) {
+    standalone_services += [ "//components/nacl/loader:nacl_loader_manifest" ]
+    if (is_win && target_cpu == "x86") {
+      standalone_services += [ "//components/nacl/broker:nacl_broker_manifest" ]
+    }
+  }
 }
 
 copy("mash_catalog") {
diff --git a/third_party/WebKit/Source/core/css/CSSProperties.json5 b/third_party/WebKit/Source/core/css/CSSProperties.json5
index 72b537e..562ef429 100644
--- a/third_party/WebKit/Source/core/css/CSSProperties.json5
+++ b/third_party/WebKit/Source/core/css/CSSProperties.json5
@@ -755,7 +755,12 @@
       inherited: true,
       interpolable: true,
     },
-    "clear",
+    {
+      name: "clear",
+      initial_keyword: "none",
+      keyword_only: true,
+      keywords: ["none", "left", "right", "both"],
+    },
     {
       name: "clip",
       api_class: true,
diff --git a/third_party/WebKit/Source/core/css/PropertyRegistration.cpp b/third_party/WebKit/Source/core/css/PropertyRegistration.cpp
index fc59149..2d049f6 100644
--- a/third_party/WebKit/Source/core/css/PropertyRegistration.cpp
+++ b/third_party/WebKit/Source/core/css/PropertyRegistration.cpp
@@ -61,7 +61,7 @@
 }
 
 void PropertyRegistration::registerProperty(
-    ExecutionContext* executionContext,
+    ScriptState* scriptState,
     const PropertyDescriptor& descriptor,
     ExceptionState& exceptionState) {
   // Bindings code ensures these are set.
@@ -76,7 +76,7 @@
     return;
   }
   AtomicString atomicName(name);
-  Document* document = toDocument(executionContext);
+  Document* document = toDocument(scriptState->getExecutionContext());
   PropertyRegistry& registry = *document->propertyRegistry();
   if (registry.registration(atomicName)) {
     exceptionState.throwDOMException(
diff --git a/third_party/WebKit/Source/core/css/PropertyRegistration.h b/third_party/WebKit/Source/core/css/PropertyRegistration.h
index 91176434..2afceab 100644
--- a/third_party/WebKit/Source/core/css/PropertyRegistration.h
+++ b/third_party/WebKit/Source/core/css/PropertyRegistration.h
@@ -11,14 +11,14 @@
 namespace blink {
 
 class ExceptionState;
-class ExecutionContext;
 class PropertyDescriptor;
+class ScriptState;
 
 class PropertyRegistration {
   STATIC_ONLY(PropertyRegistration);
 
  public:
-  static void registerProperty(ExecutionContext*,
+  static void registerProperty(ScriptState*,
                                const PropertyDescriptor&,
                                ExceptionState&);
 };
diff --git a/third_party/WebKit/Source/core/css/PropertyRegistration.idl b/third_party/WebKit/Source/core/css/PropertyRegistration.idl
index 3ce62e7..e8ef33d8 100644
--- a/third_party/WebKit/Source/core/css/PropertyRegistration.idl
+++ b/third_party/WebKit/Source/core/css/PropertyRegistration.idl
@@ -4,6 +4,6 @@
 
 // https://drafts.css-houdini.org/css-properties-values-api/#registering-custom-properties
 partial interface CSS {
-    [RuntimeEnabled=CSSVariables2, CallWith=ExecutionContext, RaisesException]
+    [RuntimeEnabled=CSSVariables2, CallWith=ScriptState, RaisesException]
         static void registerProperty(PropertyDescriptor descriptor);
 };
diff --git a/third_party/WebKit/Source/core/dom/Document.cpp b/third_party/WebKit/Source/core/dom/Document.cpp
index d0f3223..6ef0630d 100644
--- a/third_party/WebKit/Source/core/dom/Document.cpp
+++ b/third_party/WebKit/Source/core/dom/Document.cpp
@@ -4416,10 +4416,11 @@
   eventFactories().insert(std::move(eventFactory));
 }
 
-Event* Document::createEvent(ExecutionContext* executionContext,
+Event* Document::createEvent(ScriptState* scriptState,
                              const String& eventType,
                              ExceptionState& exceptionState) {
   Event* event = nullptr;
+  ExecutionContext* executionContext = scriptState->getExecutionContext();
   for (const auto& factory : eventFactories()) {
     event = factory->create(executionContext, eventType);
     if (event) {
diff --git a/third_party/WebKit/Source/core/dom/Document.h b/third_party/WebKit/Source/core/dom/Document.h
index acb3e52..427d7681 100644
--- a/third_party/WebKit/Source/core/dom/Document.h
+++ b/third_party/WebKit/Source/core/dom/Document.h
@@ -772,7 +772,7 @@
   EventListener* getWindowAttributeEventListener(const AtomicString& eventType);
 
   static void registerEventFactory(std::unique_ptr<EventFactoryBase>);
-  static Event* createEvent(ExecutionContext*,
+  static Event* createEvent(ScriptState*,
                             const String& eventType,
                             ExceptionState&);
 
diff --git a/third_party/WebKit/Source/core/dom/Document.idl b/third_party/WebKit/Source/core/dom/Document.idl
index 826a96d..87ca6f5 100644
--- a/third_party/WebKit/Source/core/dom/Document.idl
+++ b/third_party/WebKit/Source/core/dom/Document.idl
@@ -69,7 +69,7 @@
     [NewObject, RaisesException, MeasureAs=DocumentCreateAttribute] Attr createAttribute(DOMString localName);
     [NewObject, RaisesException, MeasureAs=DocumentCreateAttributeNS] Attr createAttributeNS(DOMString? namespaceURI, DOMString qualifiedName);
 
-    [NewObject, RaisesException, CallWith=ExecutionContext] Event createEvent(DOMString eventType);
+    [NewObject, RaisesException, CallWith=ScriptState] Event createEvent(DOMString eventType);
 
     [NewObject] Range createRange();
 
diff --git a/third_party/WebKit/Source/core/events/Event.cpp b/third_party/WebKit/Source/core/events/Event.cpp
index 3b27344..8799cc0 100644
--- a/third_party/WebKit/Source/core/events/Event.cpp
+++ b/third_party/WebKit/Source/core/events/Event.cpp
@@ -22,6 +22,7 @@
 
 #include "core/events/Event.h"
 
+#include "bindings/core/v8/ScriptState.h"
 #include "core/dom/StaticNodeList.h"
 #include "core/events/EventDispatchMediator.h"
 #include "core/events/EventTarget.h"
@@ -134,21 +135,26 @@
   m_cancelable = cancelableArg;
 }
 
-bool Event::legacyReturnValue(ExecutionContext* executionContext) const {
+bool Event::legacyReturnValue(ScriptState* scriptState) const {
   bool returnValue = !defaultPrevented();
-  if (returnValue)
-    UseCounter::count(executionContext, UseCounter::EventGetReturnValueTrue);
-  else
-    UseCounter::count(executionContext, UseCounter::EventGetReturnValueFalse);
+  if (returnValue) {
+    UseCounter::count(scriptState->getExecutionContext(),
+                      UseCounter::EventGetReturnValueTrue);
+  } else {
+    UseCounter::count(scriptState->getExecutionContext(),
+                      UseCounter::EventGetReturnValueFalse);
+  }
   return returnValue;
 }
 
-void Event::setLegacyReturnValue(ExecutionContext* executionContext,
-                                 bool returnValue) {
-  if (returnValue)
-    UseCounter::count(executionContext, UseCounter::EventSetReturnValueTrue);
-  else
-    UseCounter::count(executionContext, UseCounter::EventSetReturnValueFalse);
+void Event::setLegacyReturnValue(ScriptState* scriptState, bool returnValue) {
+  if (returnValue) {
+    UseCounter::count(scriptState->getExecutionContext(),
+                      UseCounter::EventSetReturnValueTrue);
+  } else {
+    UseCounter::count(scriptState->getExecutionContext(),
+                      UseCounter::EventSetReturnValueFalse);
+  }
   setDefaultPrevented(!returnValue);
 }
 
@@ -335,7 +341,7 @@
   return timeStamp;
 }
 
-void Event::setCancelBubble(ExecutionContext* context, bool cancel) {
+void Event::setCancelBubble(ScriptState* scriptState, bool cancel) {
   if (cancel)
     m_propagationStopped = true;
 }
diff --git a/third_party/WebKit/Source/core/events/Event.h b/third_party/WebKit/Source/core/events/Event.h
index d85ac87..a2b55cc 100644
--- a/third_party/WebKit/Source/core/events/Event.h
+++ b/third_party/WebKit/Source/core/events/Event.h
@@ -40,7 +40,7 @@
 class DOMWrapperWorld;
 class EventDispatchMediator;
 class EventTarget;
-class ExecutionContext;
+class ScriptState;
 
 class CORE_EXPORT Event : public GarbageCollectedFinalized<Event>,
                           public ScriptWrappable {
@@ -154,8 +154,8 @@
     return target();
   }  // MSIE extension - "the object that fired the event"
 
-  bool legacyReturnValue(ExecutionContext*) const;
-  void setLegacyReturnValue(ExecutionContext*, bool returnValue);
+  bool legacyReturnValue(ScriptState*) const;
+  void setLegacyReturnValue(ScriptState*, bool returnValue);
 
   virtual const AtomicString& interfaceName() const;
   bool hasInterface(const AtomicString&) const;
@@ -198,10 +198,10 @@
   bool defaultHandled() const { return m_defaultHandled; }
   void setDefaultHandled() { m_defaultHandled = true; }
 
-  bool cancelBubble(ExecutionContext* = nullptr) const {
+  bool cancelBubble(ScriptState* = nullptr) const {
     return propagationStopped();
   }
-  void setCancelBubble(ExecutionContext*, bool);
+  void setCancelBubble(ScriptState*, bool);
 
   Event* underlyingEvent() const { return m_underlyingEvent.get(); }
   void setUnderlyingEvent(Event*);
diff --git a/third_party/WebKit/Source/core/events/Event.idl b/third_party/WebKit/Source/core/events/Event.idl
index 82adfa6..4a9d2b0 100644
--- a/third_party/WebKit/Source/core/events/Event.idl
+++ b/third_party/WebKit/Source/core/events/Event.idl
@@ -56,7 +56,7 @@
 
     // Non-standard APIs
     [MeasureAs=EventSrcElement] readonly attribute EventTarget srcElement;
-    [MeasureAs=EventReturnValue, CallWith=ExecutionContext, ImplementedAs=legacyReturnValue] attribute boolean returnValue;
-    [MeasureAs=EventCancelBubble, CallWith=ExecutionContext] attribute boolean cancelBubble;
+    [MeasureAs=EventReturnValue, CallWith=ScriptState, ImplementedAs=legacyReturnValue] attribute boolean returnValue;
+    [MeasureAs=EventCancelBubble, CallWith=ScriptState] attribute boolean cancelBubble;
     [MeasureAs=EventPath, CallWith=ScriptState] readonly attribute EventTarget[] path;
 };
diff --git a/third_party/WebKit/Source/core/fileapi/URLFileAPI.cpp b/third_party/WebKit/Source/core/fileapi/URLFileAPI.cpp
index 3e99a22..e18e018 100644
--- a/third_party/WebKit/Source/core/fileapi/URLFileAPI.cpp
+++ b/third_party/WebKit/Source/core/fileapi/URLFileAPI.cpp
@@ -5,6 +5,7 @@
 #include "core/fileapi/URLFileAPI.h"
 
 #include "bindings/core/v8/ExceptionState.h"
+#include "bindings/core/v8/ScriptState.h"
 #include "core/dom/DOMURL.h"
 #include "core/dom/ExecutionContext.h"
 #include "core/fileapi/Blob.h"
@@ -14,10 +15,11 @@
 namespace blink {
 
 // static
-String URLFileAPI::createObjectURL(ExecutionContext* executionContext,
+String URLFileAPI::createObjectURL(ScriptState* scriptState,
                                    Blob* blob,
                                    ExceptionState& exceptionState) {
   DCHECK(blob);
+  ExecutionContext* executionContext = scriptState->getExecutionContext();
   DCHECK(executionContext);
 
   if (blob->isClosed()) {
@@ -34,8 +36,9 @@
 }
 
 // static
-void URLFileAPI::revokeObjectURL(ExecutionContext* executionContext,
+void URLFileAPI::revokeObjectURL(ScriptState* scriptState,
                                  const String& urlString) {
+  ExecutionContext* executionContext = scriptState->getExecutionContext();
   DCHECK(executionContext);
 
   KURL url(KURL(), urlString);
diff --git a/third_party/WebKit/Source/core/fileapi/URLFileAPI.h b/third_party/WebKit/Source/core/fileapi/URLFileAPI.h
index 9ffa50e..032e73cf 100644
--- a/third_party/WebKit/Source/core/fileapi/URLFileAPI.h
+++ b/third_party/WebKit/Source/core/fileapi/URLFileAPI.h
@@ -11,15 +11,15 @@
 namespace blink {
 
 class ExceptionState;
-class ExecutionContext;
+class ScriptState;
 class Blob;
 
 class URLFileAPI {
   STATIC_ONLY(URLFileAPI);
 
  public:
-  static String createObjectURL(ExecutionContext*, Blob*, ExceptionState&);
-  static void revokeObjectURL(ExecutionContext*, const String&);
+  static String createObjectURL(ScriptState*, Blob*, ExceptionState&);
+  static void revokeObjectURL(ScriptState*, const String&);
 };
 
 }  // namespace blink
diff --git a/third_party/WebKit/Source/core/fileapi/URLFileAPI.idl b/third_party/WebKit/Source/core/fileapi/URLFileAPI.idl
index c2e86a7..7f7872c 100644
--- a/third_party/WebKit/Source/core/fileapi/URLFileAPI.idl
+++ b/third_party/WebKit/Source/core/fileapi/URLFileAPI.idl
@@ -4,8 +4,8 @@
 
 // https://w3c.github.io/FileAPI/#creating-revoking
 partial interface URL {
-    [Exposed=(Window,DedicatedWorker,SharedWorker), CallWith=ExecutionContext, RaisesException] static DOMString createObjectURL(Blob blob);
+    [Exposed=(Window,DedicatedWorker,SharedWorker), CallWith=ScriptState, RaisesException] static DOMString createObjectURL(Blob blob);
     // TODO(jsbell): Implement createFor(). https://crbug.com/608460
     //static DOMString createFor(Blob blob);
-    [Exposed=(Window,DedicatedWorker,SharedWorker), CallWith=ExecutionContext] static void revokeObjectURL(DOMString url);
+    [Exposed=(Window,DedicatedWorker,SharedWorker), CallWith=ScriptState] static void revokeObjectURL(DOMString url);
 };
diff --git a/third_party/WebKit/Source/core/frame/UseCounter.h b/third_party/WebKit/Source/core/frame/UseCounter.h
index 146dca4..d044bd9 100644
--- a/third_party/WebKit/Source/core/frame/UseCounter.h
+++ b/third_party/WebKit/Source/core/frame/UseCounter.h
@@ -1443,6 +1443,10 @@
     V8MediaSession_PlaybackState_AttributeGetter = 1790,
     V8MediaSession_PlaybackState_AttributeSetter = 1791,
     V8MediaSession_SetActionHandler_Method = 1792,
+    WebNFCPush = 1793,
+    WebNFCCancelPush = 1794,
+    WebNFCWatch = 1795,
+    WebNFCCancelWatch = 1796,
 
     // Add new features immediately above this line. Don't change assigned
     // numbers of any item, and don't reuse removed slots.
diff --git a/third_party/WebKit/Source/core/style/ComputedStyle.cpp b/third_party/WebKit/Source/core/style/ComputedStyle.cpp
index 1b5ca74b..7ae1f81 100644
--- a/third_party/WebKit/Source/core/style/ComputedStyle.cpp
+++ b/third_party/WebKit/Source/core/style/ComputedStyle.cpp
@@ -81,7 +81,7 @@
   } m_inheritedData;
 
   struct NonInheritedData {
-    unsigned m_bitfields[3];
+    unsigned m_bitfields[2];
   } m_nonInheritedData;
 };
 
@@ -372,7 +372,6 @@
   m_nonInheritedData.m_overflowX = other.m_nonInheritedData.m_overflowX;
   m_nonInheritedData.m_overflowY = other.m_nonInheritedData.m_overflowY;
   m_nonInheritedData.m_verticalAlign = other.m_nonInheritedData.m_verticalAlign;
-  m_nonInheritedData.m_clear = other.m_nonInheritedData.m_clear;
   m_nonInheritedData.m_position = other.m_nonInheritedData.m_position;
   m_nonInheritedData.m_tableLayout = other.m_nonInheritedData.m_tableLayout;
   m_nonInheritedData.m_hasViewportUnits =
@@ -817,8 +816,7 @@
 
   if (m_nonInheritedData.m_overflowX != other.m_nonInheritedData.m_overflowX ||
       m_nonInheritedData.m_overflowY != other.m_nonInheritedData.m_overflowY ||
-      m_nonInheritedData.m_clear != other.m_nonInheritedData.m_clear ||
-      getUnicodeBidi() != other.getUnicodeBidi() ||
+      clear() != other.clear() || getUnicodeBidi() != other.getUnicodeBidi() ||
       floating() != other.floating() ||
       m_nonInheritedData.m_originalDisplay !=
           other.m_nonInheritedData.m_originalDisplay)
diff --git a/third_party/WebKit/Source/core/style/ComputedStyle.h b/third_party/WebKit/Source/core/style/ComputedStyle.h
index d7a251f..268ca8b6 100644
--- a/third_party/WebKit/Source/core/style/ComputedStyle.h
+++ b/third_party/WebKit/Source/core/style/ComputedStyle.h
@@ -226,7 +226,7 @@
              m_overflowX == other.m_overflowX &&
              m_overflowY == other.m_overflowY &&
              m_verticalAlign == other.m_verticalAlign &&
-             m_clear == other.m_clear && m_position == other.m_position &&
+             m_position == other.m_position &&
              m_tableLayout == other.m_tableLayout &&
              // hasViewportUnits
              m_breakBefore == other.m_breakBefore &&
@@ -255,7 +255,6 @@
     unsigned m_overflowX : 3;         // EOverflow
     unsigned m_overflowY : 3;         // EOverflow
     unsigned m_verticalAlign : 4;     // EVerticalAlign
-    unsigned m_clear : 2;             // EClear
     unsigned m_position : 3;          // EPosition
     unsigned m_tableLayout : 1;       // ETableLayout
 
@@ -313,7 +312,6 @@
     m_nonInheritedData.m_overflowY = static_cast<unsigned>(initialOverflowY());
     m_nonInheritedData.m_verticalAlign =
         static_cast<unsigned>(initialVerticalAlign());
-    m_nonInheritedData.m_clear = static_cast<unsigned>(initialClear());
     m_nonInheritedData.m_position = initialPosition();
     m_nonInheritedData.m_tableLayout =
         static_cast<unsigned>(initialTableLayout());
@@ -766,15 +764,6 @@
     SET_VAR(m_box, m_boxSizing, static_cast<unsigned>(s));
   }
 
-  // clear
-  static EClear initialClear() { return EClear::kNone; }
-  EClear clear() const {
-    return static_cast<EClear>(m_nonInheritedData.m_clear);
-  }
-  void setClear(EClear v) {
-    m_nonInheritedData.m_clear = static_cast<unsigned>(v);
-  }
-
   // Page break properties.
   // break-after (shorthand for page-break-after and -webkit-column-break-after)
   static EBreak initialBreakAfter() { return BreakAuto; }
diff --git a/third_party/WebKit/Source/core/style/ComputedStyleConstants.h b/third_party/WebKit/Source/core/style/ComputedStyleConstants.h
index 998f74cd..74209a4fd 100644
--- a/third_party/WebKit/Source/core/style/ComputedStyleConstants.h
+++ b/third_party/WebKit/Source/core/style/ComputedStyleConstants.h
@@ -169,8 +169,6 @@
   Length
 };
 
-enum class EClear : unsigned { kNone, kLeft, kRight, kBoth };
-
 enum class ETableLayout : unsigned { kAuto, kFixed };
 
 enum TextCombine { TextCombineNone, TextCombineAll };
diff --git a/third_party/WebKit/Source/devtools/front_end/sdk/CSSMetadata.js b/third_party/WebKit/Source/devtools/front_end/sdk/CSSMetadata.js
index 2ecea91..9646937 100644
--- a/third_party/WebKit/Source/devtools/front_end/sdk/CSSMetadata.js
+++ b/third_party/WebKit/Source/devtools/front_end/sdk/CSSMetadata.js
@@ -589,7 +589,7 @@
   'page-break-before': {values: ['left', 'right', 'auto', 'always', 'avoid']},
   'border-image': {values: ['repeat', 'stretch']},
   'text-decoration': {values: ['none', 'blink', 'line-through', 'overline', 'underline']},
-  'position': {values: ['absolute', 'fixed', 'relative', 'static']},
+  'position': {values: ['absolute', 'fixed', 'relative', 'static', 'sticky']},
   'font-family':
       {values: ['serif', 'sans-serif', 'cursive', 'fantasy', 'monospace', '-webkit-body', '-webkit-pictograph']},
   'text-overflow-mode': {values: ['clip', 'ellipsis']},
diff --git a/third_party/WebKit/Source/modules/mediacapturefromelement/CanvasCaptureMediaStreamTrack.cpp b/third_party/WebKit/Source/modules/mediacapturefromelement/CanvasCaptureMediaStreamTrack.cpp
index d2a8561..d4a2a29 100644
--- a/third_party/WebKit/Source/modules/mediacapturefromelement/CanvasCaptureMediaStreamTrack.cpp
+++ b/third_party/WebKit/Source/modules/mediacapturefromelement/CanvasCaptureMediaStreamTrack.cpp
@@ -39,7 +39,7 @@
 }
 
 CanvasCaptureMediaStreamTrack* CanvasCaptureMediaStreamTrack::clone(
-    ExecutionContext* context) {
+    ScriptState* scriptState) {
   MediaStreamComponent* clonedComponent = component()->clone();
   CanvasCaptureMediaStreamTrack* clonedTrack =
       new CanvasCaptureMediaStreamTrack(*this, clonedComponent);
diff --git a/third_party/WebKit/Source/modules/mediacapturefromelement/CanvasCaptureMediaStreamTrack.h b/third_party/WebKit/Source/modules/mediacapturefromelement/CanvasCaptureMediaStreamTrack.h
index 95ec885..e58aa5dc 100644
--- a/third_party/WebKit/Source/modules/mediacapturefromelement/CanvasCaptureMediaStreamTrack.h
+++ b/third_party/WebKit/Source/modules/mediacapturefromelement/CanvasCaptureMediaStreamTrack.h
@@ -32,7 +32,7 @@
   HTMLCanvasElement* canvas() const;
   void requestFrame();
 
-  CanvasCaptureMediaStreamTrack* clone(ExecutionContext*) override;
+  CanvasCaptureMediaStreamTrack* clone(ScriptState*) override;
 
   DECLARE_VIRTUAL_TRACE();
 
diff --git a/third_party/WebKit/Source/modules/mediasource/URLMediaSource.cpp b/third_party/WebKit/Source/modules/mediasource/URLMediaSource.cpp
index 3aae6826..25a5149 100644
--- a/third_party/WebKit/Source/modules/mediasource/URLMediaSource.cpp
+++ b/third_party/WebKit/Source/modules/mediasource/URLMediaSource.cpp
@@ -36,11 +36,12 @@
 
 namespace blink {
 
-String URLMediaSource::createObjectURL(ExecutionContext* executionContext,
+String URLMediaSource::createObjectURL(ScriptState* scriptState,
                                        MediaSource* source) {
   // Since WebWorkers cannot obtain MediaSource objects, we should be on the
   // main thread.
   DCHECK(isMainThread());
+  ExecutionContext* executionContext = scriptState->getExecutionContext();
   DCHECK(executionContext);
   DCHECK(source);
 
diff --git a/third_party/WebKit/Source/modules/mediasource/URLMediaSource.h b/third_party/WebKit/Source/modules/mediasource/URLMediaSource.h
index 49a5e64..353fdbf 100644
--- a/third_party/WebKit/Source/modules/mediasource/URLMediaSource.h
+++ b/third_party/WebKit/Source/modules/mediasource/URLMediaSource.h
@@ -37,13 +37,13 @@
 namespace blink {
 
 class MediaSource;
-class ExecutionContext;
+class ScriptState;
 
 class URLMediaSource {
   STATIC_ONLY(URLMediaSource);
 
  public:
-  static String createObjectURL(ExecutionContext*, MediaSource*);
+  static String createObjectURL(ScriptState*, MediaSource*);
 };
 
 }  // namespace blink
diff --git a/third_party/WebKit/Source/modules/mediasource/URLMediaSource.idl b/third_party/WebKit/Source/modules/mediasource/URLMediaSource.idl
index 33f026a..4d23bb8f 100644
--- a/third_party/WebKit/Source/modules/mediasource/URLMediaSource.idl
+++ b/third_party/WebKit/Source/modules/mediasource/URLMediaSource.idl
@@ -31,5 +31,5 @@
 // https://w3c.github.io/media-source/#url
 
 partial interface URL {
-    [Exposed=(Window,DedicatedWorker,SharedWorker), CallWith=ExecutionContext] static DOMString createObjectURL(MediaSource source);
+    [Exposed=(Window,DedicatedWorker,SharedWorker), CallWith=ScriptState] static DOMString createObjectURL(MediaSource source);
 };
diff --git a/third_party/WebKit/Source/modules/mediastream/MediaStream.cpp b/third_party/WebKit/Source/modules/mediastream/MediaStream.cpp
index 461f0ec6..f5051bf0 100644
--- a/third_party/WebKit/Source/modules/mediastream/MediaStream.cpp
+++ b/third_party/WebKit/Source/modules/mediastream/MediaStream.cpp
@@ -26,7 +26,9 @@
 #include "modules/mediastream/MediaStream.h"
 
 #include "bindings/core/v8/ExceptionState.h"
+#include "bindings/core/v8/ScriptState.h"
 #include "core/dom/ExceptionCode.h"
+#include "core/dom/ExecutionContext.h"
 #include "core/dom/TaskRunnerHelper.h"
 #include "core/frame/Deprecation.h"
 #include "modules/mediastream/MediaStreamRegistry.h"
@@ -274,14 +276,15 @@
   return 0;
 }
 
-MediaStream* MediaStream::clone(ExecutionContext* context) {
+MediaStream* MediaStream::clone(ScriptState* scriptState) {
   MediaStreamTrackVector tracks;
+  ExecutionContext* context = scriptState->getExecutionContext();
   for (MediaStreamTrackVector::iterator iter = m_audioTracks.begin();
        iter != m_audioTracks.end(); ++iter)
-    tracks.push_back((*iter)->clone(context));
+    tracks.push_back((*iter)->clone(scriptState));
   for (MediaStreamTrackVector::iterator iter = m_videoTracks.begin();
        iter != m_videoTracks.end(); ++iter)
-    tracks.push_back((*iter)->clone(context));
+    tracks.push_back((*iter)->clone(scriptState));
   return MediaStream::create(context, tracks);
 }
 
diff --git a/third_party/WebKit/Source/modules/mediastream/MediaStream.h b/third_party/WebKit/Source/modules/mediastream/MediaStream.h
index 18f414d..2e3e2ce 100644
--- a/third_party/WebKit/Source/modules/mediastream/MediaStream.h
+++ b/third_party/WebKit/Source/modules/mediastream/MediaStream.h
@@ -26,7 +26,6 @@
 #ifndef MediaStream_h
 #define MediaStream_h
 
-#include "core/dom/ExecutionContext.h"
 #include "core/html/URLRegistry.h"
 #include "modules/EventTargetModules.h"
 #include "modules/ModulesExport.h"
@@ -37,6 +36,8 @@
 namespace blink {
 
 class ExceptionState;
+class ExecutionContext;
+class ScriptState;
 
 class MODULES_EXPORT MediaStream final : public EventTargetWithInlineData,
                                          public ContextClient,
@@ -57,7 +58,7 @@
   void addTrack(MediaStreamTrack*, ExceptionState&);
   void removeTrack(MediaStreamTrack*, ExceptionState&);
   MediaStreamTrack* getTrackById(String);
-  MediaStream* clone(ExecutionContext*);
+  MediaStream* clone(ScriptState*);
 
   MediaStreamTrackVector getAudioTracks() const { return m_audioTracks; }
   MediaStreamTrackVector getVideoTracks() const { return m_videoTracks; }
diff --git a/third_party/WebKit/Source/modules/mediastream/MediaStream.idl b/third_party/WebKit/Source/modules/mediastream/MediaStream.idl
index 7c7d87bc..a440007 100644
--- a/third_party/WebKit/Source/modules/mediastream/MediaStream.idl
+++ b/third_party/WebKit/Source/modules/mediastream/MediaStream.idl
@@ -38,7 +38,7 @@
     MediaStreamTrack? getTrackById(DOMString trackId);
     [RaisesException] void addTrack(MediaStreamTrack track);
     [RaisesException] void removeTrack(MediaStreamTrack track);
-    [CallWith=ExecutionContext] MediaStream clone();
+    [CallWith=ScriptState] MediaStream clone();
     [Measure] readonly attribute boolean active;
     attribute EventHandler onaddtrack;
     attribute EventHandler onremovetrack;
diff --git a/third_party/WebKit/Source/modules/mediastream/MediaStreamTrack.cpp b/third_party/WebKit/Source/modules/mediastream/MediaStreamTrack.cpp
index 93c48d7..08880ba 100644
--- a/third_party/WebKit/Source/modules/mediastream/MediaStreamTrack.cpp
+++ b/third_party/WebKit/Source/modules/mediastream/MediaStreamTrack.cpp
@@ -198,12 +198,12 @@
   propagateTrackEnded();
 }
 
-MediaStreamTrack* MediaStreamTrack::clone(ExecutionContext* context) {
+MediaStreamTrack* MediaStreamTrack::clone(ScriptState* scriptState) {
   // TODO(pbos): Make sure m_readyState and m_stopped carries over on cloned
   // tracks.
   MediaStreamComponent* clonedComponent = component()->clone();
-  MediaStreamTrack* clonedTrack =
-      MediaStreamTrack::create(context, clonedComponent);
+  MediaStreamTrack* clonedTrack = MediaStreamTrack::create(
+      scriptState->getExecutionContext(), clonedComponent);
   MediaStreamCenter::instance().didCreateMediaStreamTrack(clonedComponent);
   return clonedTrack;
 }
diff --git a/third_party/WebKit/Source/modules/mediastream/MediaStreamTrack.h b/third_party/WebKit/Source/modules/mediastream/MediaStreamTrack.h
index bc7d614..0502e8e 100644
--- a/third_party/WebKit/Source/modules/mediastream/MediaStreamTrack.h
+++ b/third_party/WebKit/Source/modules/mediastream/MediaStreamTrack.h
@@ -72,7 +72,7 @@
   String readyState() const;
 
   void stopTrack(ExceptionState&);
-  virtual MediaStreamTrack* clone(ExecutionContext*);
+  virtual MediaStreamTrack* clone(ScriptState*);
 
   void getConstraints(MediaTrackConstraints&);
 
diff --git a/third_party/WebKit/Source/modules/mediastream/MediaStreamTrack.idl b/third_party/WebKit/Source/modules/mediastream/MediaStreamTrack.idl
index 07a29a2..b87e17e 100644
--- a/third_party/WebKit/Source/modules/mediastream/MediaStreamTrack.idl
+++ b/third_party/WebKit/Source/modules/mediastream/MediaStreamTrack.idl
@@ -47,7 +47,7 @@
     readonly attribute MediaStreamTrackState readyState;
     attribute EventHandler onended;
 
-    [CallWith=ExecutionContext] MediaStreamTrack clone();
+    [CallWith=ScriptState] MediaStreamTrack clone();
     [ImplementedAs=stopTrack, RaisesException] void stop();
     [RuntimeEnabled=MediaConstraints] MediaTrackConstraints getConstraints();
     [RuntimeEnabled=MediaGetSettings] MediaTrackSettings getSettings();
diff --git a/third_party/WebKit/Source/modules/mediastream/URLMediaStream.cpp b/third_party/WebKit/Source/modules/mediastream/URLMediaStream.cpp
index 552239d..3276aac 100644
--- a/third_party/WebKit/Source/modules/mediastream/URLMediaStream.cpp
+++ b/third_party/WebKit/Source/modules/mediastream/URLMediaStream.cpp
@@ -36,11 +36,12 @@
 
 namespace blink {
 
-String URLMediaStream::createObjectURL(ExecutionContext* executionContext,
+String URLMediaStream::createObjectURL(ScriptState* scriptState,
                                        MediaStream* stream) {
   // Since WebWorkers cannot obtain Stream objects, we should be on the main
   // thread.
   DCHECK(isMainThread());
+  ExecutionContext* executionContext = scriptState->getExecutionContext();
   DCHECK(executionContext);
   DCHECK(stream);
 
diff --git a/third_party/WebKit/Source/modules/mediastream/URLMediaStream.h b/third_party/WebKit/Source/modules/mediastream/URLMediaStream.h
index 7f7266d8..da22ba1 100644
--- a/third_party/WebKit/Source/modules/mediastream/URLMediaStream.h
+++ b/third_party/WebKit/Source/modules/mediastream/URLMediaStream.h
@@ -37,13 +37,13 @@
 namespace blink {
 
 class MediaStream;
-class ExecutionContext;
+class ScriptState;
 
 class URLMediaStream {
   STATIC_ONLY(URLMediaStream);
 
  public:
-  static String createObjectURL(ExecutionContext*, MediaStream*);
+  static String createObjectURL(ScriptState*, MediaStream*);
 };
 
 }  // namespace blink
diff --git a/third_party/WebKit/Source/modules/mediastream/URLMediaStream.idl b/third_party/WebKit/Source/modules/mediastream/URLMediaStream.idl
index 3f0f0e5..b19c9c95 100644
--- a/third_party/WebKit/Source/modules/mediastream/URLMediaStream.idl
+++ b/third_party/WebKit/Source/modules/mediastream/URLMediaStream.idl
@@ -35,5 +35,5 @@
 // https://github.com/w3c/mediacapture-main/issues/404
 
 partial interface URL {
-    [Exposed=(Window,DedicatedWorker,SharedWorker), CallWith=ExecutionContext] static DOMString createObjectURL(MediaStream stream);
+    [Exposed=(Window,DedicatedWorker,SharedWorker), CallWith=ScriptState] static DOMString createObjectURL(MediaStream stream);
 };
diff --git a/third_party/WebKit/Source/modules/nfc/NFC.idl b/third_party/WebKit/Source/modules/nfc/NFC.idl
index f095f64..93261753 100644
--- a/third_party/WebKit/Source/modules/nfc/NFC.idl
+++ b/third_party/WebKit/Source/modules/nfc/NFC.idl
@@ -9,8 +9,8 @@
 [
   RuntimeEnabled=WebNFC,
 ] interface NFC {
-    [CallWith=ScriptState] Promise<void> push (NFCPushMessage message, optional NFCPushOptions options);
-    [CallWith=ScriptState] Promise<void> cancelPush (optional NFCPushTarget target = "any");
-    [CallWith=ScriptState] Promise<long> watch (MessageCallback callback, optional NFCWatchOptions options);
-    [CallWith=ScriptState] Promise<void> cancelWatch (optional long id);
+    [CallWith=ScriptState, MeasureAs=WebNFCPush] Promise<void> push (NFCPushMessage message, optional NFCPushOptions options);
+    [CallWith=ScriptState, MeasureAs=WebNFCCancelPush] Promise<void> cancelPush (optional NFCPushTarget target = "any");
+    [CallWith=ScriptState, MeasureAs=WebNFCWatch] Promise<long> watch (MessageCallback callback, optional NFCWatchOptions options);
+    [CallWith=ScriptState, MeasureAs=WebNFCCancelWatch] Promise<void> cancelWatch (optional long id);
 };
diff --git a/third_party/WebKit/Source/modules/peerconnection/RTCPeerConnection.cpp b/third_party/WebKit/Source/modules/peerconnection/RTCPeerConnection.cpp
index a1e119c..85cb675df 100644
--- a/third_party/WebKit/Source/modules/peerconnection/RTCPeerConnection.cpp
+++ b/third_party/WebKit/Source/modules/peerconnection/RTCPeerConnection.cpp
@@ -791,14 +791,14 @@
 }
 
 void RTCPeerConnection::setConfiguration(
-    ExecutionContext* context,
+    ScriptState* scriptState,
     const RTCConfiguration& rtcConfiguration,
     ExceptionState& exceptionState) {
   if (throwExceptionIfSignalingStateClosed(m_signalingState, exceptionState))
     return;
 
-  WebRTCConfiguration configuration =
-      parseConfiguration(context, rtcConfiguration, exceptionState);
+  WebRTCConfiguration configuration = parseConfiguration(
+      scriptState->getExecutionContext(), rtcConfiguration, exceptionState);
 
   if (exceptionState.hadException())
     return;
@@ -1061,7 +1061,7 @@
   return String();
 }
 
-void RTCPeerConnection::addStream(ExecutionContext* context,
+void RTCPeerConnection::addStream(ScriptState* scriptState,
                                   MediaStream* stream,
                                   const Dictionary& mediaConstraints,
                                   ExceptionState& exceptionState) {
@@ -1079,8 +1079,8 @@
     return;
 
   MediaErrorState mediaErrorState;
-  WebMediaConstraints constraints =
-      MediaConstraintsImpl::create(context, mediaConstraints, mediaErrorState);
+  WebMediaConstraints constraints = MediaConstraintsImpl::create(
+      scriptState->getExecutionContext(), mediaConstraints, mediaErrorState);
   if (mediaErrorState.hadException()) {
     mediaErrorState.raiseException(exceptionState);
     return;
@@ -1169,7 +1169,7 @@
 }
 
 RTCDataChannel* RTCPeerConnection::createDataChannel(
-    ExecutionContext* context,
+    ScriptState* scriptState,
     String label,
     const Dictionary& options,
     ExceptionState& exceptionState) {
@@ -1181,6 +1181,7 @@
   DictionaryHelper::get(options, "negotiated", init.negotiated);
 
   unsigned short value = 0;
+  ExecutionContext* context = scriptState->getExecutionContext();
   if (DictionaryHelper::get(options, "id", value))
     init.id = value;
   if (DictionaryHelper::get(options, "maxRetransmits", value)) {
diff --git a/third_party/WebKit/Source/modules/peerconnection/RTCPeerConnection.h b/third_party/WebKit/Source/modules/peerconnection/RTCPeerConnection.h
index 413f2707..987ef0f 100644
--- a/third_party/WebKit/Source/modules/peerconnection/RTCPeerConnection.h
+++ b/third_party/WebKit/Source/modules/peerconnection/RTCPeerConnection.h
@@ -108,9 +108,7 @@
 
   String signalingState() const;
 
-  void setConfiguration(ExecutionContext*,
-                        const RTCConfiguration&,
-                        ExceptionState&);
+  void setConfiguration(ScriptState*, const RTCConfiguration&, ExceptionState&);
 
   // Certificate management
   // http://w3c.github.io/webrtc-pc/#sec.cert-mgmt
@@ -136,7 +134,7 @@
 
   MediaStream* getStreamById(const String& streamId);
 
-  void addStream(ExecutionContext*,
+  void addStream(ScriptState*,
                  MediaStream*,
                  const Dictionary& mediaConstraints,
                  ExceptionState&);
@@ -148,7 +146,7 @@
                          MediaStreamTrack* selector = nullptr);
   ScriptPromise getStats(ScriptState*);
 
-  RTCDataChannel* createDataChannel(ExecutionContext*,
+  RTCDataChannel* createDataChannel(ScriptState*,
                                     String label,
                                     const Dictionary& dataChannelDict,
                                     ExceptionState&);
diff --git a/third_party/WebKit/Source/modules/peerconnection/RTCPeerConnection.idl b/third_party/WebKit/Source/modules/peerconnection/RTCPeerConnection.idl
index 81853fe..af35b94 100644
--- a/third_party/WebKit/Source/modules/peerconnection/RTCPeerConnection.idl
+++ b/third_party/WebKit/Source/modules/peerconnection/RTCPeerConnection.idl
@@ -84,7 +84,7 @@
     readonly attribute RTCIceConnectionState iceConnectionState;
     // readonly attribute boolean? canTrickleIceCandidates;
     // RTCConfiguration getConfiguration();
-    [CallWith=ExecutionContext, RaisesException] void setConfiguration(RTCConfiguration configuration);
+    [CallWith=ScriptState, RaisesException] void setConfiguration(RTCConfiguration configuration);
     // TODO(guidou): close() should never throw an exception.
     [RaisesException] void close();
     attribute EventHandler onnegotiationneeded;
@@ -115,7 +115,7 @@
     // https://w3c.github.io/webrtc-pc/#peer-to-peer-data-api
     // TODO(guidou): The label argument should have [TreatNullAs=EmptyString]
     // and be non-nullable.
-    [CallWith=ExecutionContext, RaisesException] RTCDataChannel createDataChannel(DOMString? label, optional Dictionary options);
+    [CallWith=ScriptState, RaisesException] RTCDataChannel createDataChannel(DOMString? label, optional Dictionary options);
     attribute EventHandler ondatachannel;
 
     // Certificate management
@@ -126,7 +126,7 @@
     [Measure] sequence<MediaStream> getLocalStreams();
     [Measure] sequence<MediaStream> getRemoteStreams();
     [Measure] MediaStream getStreamById(DOMString streamId);
-    [Measure, CallWith=ExecutionContext, RaisesException] void addStream(MediaStream? stream, optional Dictionary mediaConstraints);
+    [Measure, CallWith=ScriptState, RaisesException] void addStream(MediaStream? stream, optional Dictionary mediaConstraints);
     [Measure, RaisesException] void removeStream(MediaStream? stream);
     [Measure, RaisesException] RTCDTMFSender createDTMFSender(MediaStreamTrack track);
     attribute EventHandler onaddstream;
diff --git a/third_party/WebKit/Source/modules/quota/DeprecatedStorageInfo.cpp b/third_party/WebKit/Source/modules/quota/DeprecatedStorageInfo.cpp
index 23367b3..ed923d4 100644
--- a/third_party/WebKit/Source/modules/quota/DeprecatedStorageInfo.cpp
+++ b/third_party/WebKit/Source/modules/quota/DeprecatedStorageInfo.cpp
@@ -30,8 +30,8 @@
 
 #include "modules/quota/DeprecatedStorageInfo.h"
 
+#include "bindings/core/v8/ScriptState.h"
 #include "core/dom/ExceptionCode.h"
-#include "core/dom/ExecutionContext.h"
 #include "core/dom/TaskRunnerHelper.h"
 #include "modules/quota/DeprecatedStorageQuota.h"
 #include "modules/quota/StorageErrorCallback.h"
@@ -44,7 +44,7 @@
 DeprecatedStorageInfo::DeprecatedStorageInfo() {}
 
 void DeprecatedStorageInfo::queryUsageAndQuota(
-    ExecutionContext* executionContext,
+    ScriptState* scriptState,
     int storageType,
     StorageUsageCallback* successCallback,
     StorageErrorCallback* errorCallback) {
@@ -53,16 +53,16 @@
   DeprecatedStorageQuota* storageQuota = getStorageQuota(storageType);
   if (!storageQuota) {
     // Unknown storage type is requested.
-    executionContext->postTask(TaskType::MiscPlatformAPI, BLINK_FROM_HERE,
-                               StorageErrorCallback::createSameThreadTask(
-                                   errorCallback, NotSupportedError));
+    scriptState->getExecutionContext()->postTask(
+        TaskType::MiscPlatformAPI, BLINK_FROM_HERE,
+        StorageErrorCallback::createSameThreadTask(errorCallback,
+                                                   NotSupportedError));
     return;
   }
-  storageQuota->queryUsageAndQuota(executionContext, successCallback,
-                                   errorCallback);
+  storageQuota->queryUsageAndQuota(scriptState, successCallback, errorCallback);
 }
 
-void DeprecatedStorageInfo::requestQuota(ExecutionContext* executionContext,
+void DeprecatedStorageInfo::requestQuota(ScriptState* scriptState,
                                          int storageType,
                                          unsigned long long newQuotaInBytes,
                                          StorageQuotaCallback* successCallback,
@@ -72,12 +72,13 @@
   DeprecatedStorageQuota* storageQuota = getStorageQuota(storageType);
   if (!storageQuota) {
     // Unknown storage type is requested.
-    executionContext->postTask(TaskType::MiscPlatformAPI, BLINK_FROM_HERE,
-                               StorageErrorCallback::createSameThreadTask(
-                                   errorCallback, NotSupportedError));
+    scriptState->getExecutionContext()->postTask(
+        TaskType::MiscPlatformAPI, BLINK_FROM_HERE,
+        StorageErrorCallback::createSameThreadTask(errorCallback,
+                                                   NotSupportedError));
     return;
   }
-  storageQuota->requestQuota(executionContext, newQuotaInBytes, successCallback,
+  storageQuota->requestQuota(scriptState, newQuotaInBytes, successCallback,
                              errorCallback);
 }
 
diff --git a/third_party/WebKit/Source/modules/quota/DeprecatedStorageInfo.h b/third_party/WebKit/Source/modules/quota/DeprecatedStorageInfo.h
index 14385cea..1bd9edd 100644
--- a/third_party/WebKit/Source/modules/quota/DeprecatedStorageInfo.h
+++ b/third_party/WebKit/Source/modules/quota/DeprecatedStorageInfo.h
@@ -38,7 +38,7 @@
 
 namespace blink {
 
-class ExecutionContext;
+class ScriptState;
 class StorageErrorCallback;
 class StorageQuotaCallback;
 class StorageUsageCallback;
@@ -56,12 +56,12 @@
 
   static DeprecatedStorageInfo* create() { return new DeprecatedStorageInfo(); }
 
-  void queryUsageAndQuota(ExecutionContext*,
+  void queryUsageAndQuota(ScriptState*,
                           int storageType,
                           StorageUsageCallback*,
                           StorageErrorCallback*);
 
-  void requestQuota(ExecutionContext*,
+  void requestQuota(ScriptState*,
                     int storageType,
                     unsigned long long newQuotaInBytes,
                     StorageQuotaCallback*,
diff --git a/third_party/WebKit/Source/modules/quota/DeprecatedStorageInfo.idl b/third_party/WebKit/Source/modules/quota/DeprecatedStorageInfo.idl
index 14bd970..7638dc5 100644
--- a/third_party/WebKit/Source/modules/quota/DeprecatedStorageInfo.idl
+++ b/third_party/WebKit/Source/modules/quota/DeprecatedStorageInfo.idl
@@ -29,6 +29,6 @@
     const unsigned short TEMPORARY = 0;
     const unsigned short PERSISTENT = 1;
 
-    [CallWith=ExecutionContext] void queryUsageAndQuota(unsigned short storageType, optional StorageUsageCallback usageCallback, optional StorageErrorCallback errorCallback);
-    [CallWith=ExecutionContext] void requestQuota(unsigned short storageType, unsigned long long newQuotaInBytes, optional StorageQuotaCallback quotaCallback, optional StorageErrorCallback errorCallback);
+    [CallWith=ScriptState] void queryUsageAndQuota(unsigned short storageType, optional StorageUsageCallback usageCallback, optional StorageErrorCallback errorCallback);
+    [CallWith=ScriptState] void requestQuota(unsigned short storageType, unsigned long long newQuotaInBytes, optional StorageQuotaCallback quotaCallback, optional StorageErrorCallback errorCallback);
 };
diff --git a/third_party/WebKit/Source/modules/quota/DeprecatedStorageQuota.cpp b/third_party/WebKit/Source/modules/quota/DeprecatedStorageQuota.cpp
index 8406473f..98d4669 100644
--- a/third_party/WebKit/Source/modules/quota/DeprecatedStorageQuota.cpp
+++ b/third_party/WebKit/Source/modules/quota/DeprecatedStorageQuota.cpp
@@ -30,6 +30,7 @@
 
 #include "modules/quota/DeprecatedStorageQuota.h"
 
+#include "bindings/core/v8/ScriptState.h"
 #include "core/dom/ExceptionCode.h"
 #include "core/dom/ExecutionContext.h"
 #include "core/dom/TaskRunnerHelper.h"
@@ -50,9 +51,10 @@
 DeprecatedStorageQuota::DeprecatedStorageQuota(Type type) : m_type(type) {}
 
 void DeprecatedStorageQuota::queryUsageAndQuota(
-    ExecutionContext* executionContext,
+    ScriptState* scriptState,
     StorageUsageCallback* successCallback,
     StorageErrorCallback* errorCallback) {
+  ExecutionContext* executionContext = scriptState->getExecutionContext();
   ASSERT(executionContext);
 
   WebStorageQuotaType storageType = static_cast<WebStorageQuotaType>(m_type);
@@ -81,10 +83,11 @@
                                                  callbacks);
 }
 
-void DeprecatedStorageQuota::requestQuota(ExecutionContext* executionContext,
+void DeprecatedStorageQuota::requestQuota(ScriptState* scriptState,
                                           unsigned long long newQuotaInBytes,
                                           StorageQuotaCallback* successCallback,
                                           StorageErrorCallback* errorCallback) {
+  ExecutionContext* executionContext = scriptState->getExecutionContext();
   ASSERT(executionContext);
 
   WebStorageQuotaType storageType = static_cast<WebStorageQuotaType>(m_type);
@@ -105,7 +108,7 @@
     return;
   }
 
-  client->requestQuota(executionContext, storageType, newQuotaInBytes,
+  client->requestQuota(scriptState, storageType, newQuotaInBytes,
                        successCallback, errorCallback);
 }
 
diff --git a/third_party/WebKit/Source/modules/quota/DeprecatedStorageQuota.h b/third_party/WebKit/Source/modules/quota/DeprecatedStorageQuota.h
index b19c2aac..71aa9980 100644
--- a/third_party/WebKit/Source/modules/quota/DeprecatedStorageQuota.h
+++ b/third_party/WebKit/Source/modules/quota/DeprecatedStorageQuota.h
@@ -36,7 +36,7 @@
 
 namespace blink {
 
-class ExecutionContext;
+class ScriptState;
 class StorageErrorCallback;
 class StorageQuotaCallback;
 class StorageUsageCallback;
@@ -56,11 +56,11 @@
     return new DeprecatedStorageQuota(type);
   }
 
-  void queryUsageAndQuota(ExecutionContext*,
+  void queryUsageAndQuota(ScriptState*,
                           StorageUsageCallback*,
                           StorageErrorCallback*);
 
-  void requestQuota(ExecutionContext*,
+  void requestQuota(ScriptState*,
                     unsigned long long newQuotaInBytes,
                     StorageQuotaCallback*,
                     StorageErrorCallback*);
diff --git a/third_party/WebKit/Source/modules/quota/DeprecatedStorageQuota.idl b/third_party/WebKit/Source/modules/quota/DeprecatedStorageQuota.idl
index 5459fd3..0abbbd36 100644
--- a/third_party/WebKit/Source/modules/quota/DeprecatedStorageQuota.idl
+++ b/third_party/WebKit/Source/modules/quota/DeprecatedStorageQuota.idl
@@ -26,6 +26,6 @@
 [
     NoInterfaceObject
 ] interface DeprecatedStorageQuota {
-    [CallWith=ExecutionContext] void queryUsageAndQuota(StorageUsageCallback usageCallback, optional StorageErrorCallback errorCallback);
-    [CallWith=ExecutionContext] void requestQuota(unsigned long long newQuotaInBytes, optional StorageQuotaCallback quotaCallback, optional StorageErrorCallback errorCallback);
+    [CallWith=ScriptState] void queryUsageAndQuota(StorageUsageCallback usageCallback, optional StorageErrorCallback errorCallback);
+    [CallWith=ScriptState] void requestQuota(unsigned long long newQuotaInBytes, optional StorageQuotaCallback quotaCallback, optional StorageErrorCallback errorCallback);
 };
diff --git a/third_party/WebKit/Source/modules/quota/StorageQuotaClient.h b/third_party/WebKit/Source/modules/quota/StorageQuotaClient.h
index 865d145..d0962d9 100644
--- a/third_party/WebKit/Source/modules/quota/StorageQuotaClient.h
+++ b/third_party/WebKit/Source/modules/quota/StorageQuotaClient.h
@@ -54,7 +54,7 @@
   StorageQuotaClient() {}
   virtual ~StorageQuotaClient() {}
 
-  virtual void requestQuota(ExecutionContext*,
+  virtual void requestQuota(ScriptState*,
                             WebStorageQuotaType,
                             unsigned long long newQuotaInBytes,
                             StorageQuotaCallback*,
diff --git a/third_party/WebKit/Source/modules/speech/SpeechGrammar.cpp b/third_party/WebKit/Source/modules/speech/SpeechGrammar.cpp
index 5697819..96553634 100644
--- a/third_party/WebKit/Source/modules/speech/SpeechGrammar.cpp
+++ b/third_party/WebKit/Source/modules/speech/SpeechGrammar.cpp
@@ -37,9 +37,8 @@
   return new SpeechGrammar(src, weight);
 }
 
-void SpeechGrammar::setSrc(ExecutionContext* executionContext,
-                           const String& src) {
-  Document* document = toDocument(executionContext);
+void SpeechGrammar::setSrc(ScriptState* scriptState, const String& src) {
+  Document* document = toDocument(scriptState->getExecutionContext());
   m_src = document->completeURL(src);
 }
 
diff --git a/third_party/WebKit/Source/modules/speech/SpeechGrammar.h b/third_party/WebKit/Source/modules/speech/SpeechGrammar.h
index 6ce0e70..9d67075 100644
--- a/third_party/WebKit/Source/modules/speech/SpeechGrammar.h
+++ b/third_party/WebKit/Source/modules/speech/SpeechGrammar.h
@@ -34,7 +34,7 @@
 
 namespace blink {
 
-class ExecutionContext;
+class ScriptState;
 
 class MODULES_EXPORT SpeechGrammar final
     : public GarbageCollectedFinalized<SpeechGrammar>,
@@ -46,9 +46,9 @@
                                    // constructor should look like.
   static SpeechGrammar* create(const KURL& src, double weight);
 
-  const KURL& src(ExecutionContext*) const { return m_src; }
+  const KURL& src(ScriptState*) const { return m_src; }
   const KURL& src() const { return m_src; }
-  void setSrc(ExecutionContext*, const String& src);
+  void setSrc(ScriptState*, const String& src);
 
   double weight() const { return m_weight; }
   void setWeight(double weight) { m_weight = weight; }
diff --git a/third_party/WebKit/Source/modules/speech/SpeechGrammar.idl b/third_party/WebKit/Source/modules/speech/SpeechGrammar.idl
index c16aedc..44a6c5f 100644
--- a/third_party/WebKit/Source/modules/speech/SpeechGrammar.idl
+++ b/third_party/WebKit/Source/modules/speech/SpeechGrammar.idl
@@ -29,6 +29,6 @@
     Constructor,
     NoInterfaceObject,
 ] interface SpeechGrammar {
-    [URL,CallWith=ExecutionContext] attribute DOMString src;
+    [URL,CallWith=ScriptState] attribute DOMString src;
     attribute float weight;
 };
diff --git a/third_party/WebKit/Source/web/StorageQuotaClientImpl.cpp b/third_party/WebKit/Source/web/StorageQuotaClientImpl.cpp
index 0ced62c..c844aff2 100644
--- a/third_party/WebKit/Source/web/StorageQuotaClientImpl.cpp
+++ b/third_party/WebKit/Source/web/StorageQuotaClientImpl.cpp
@@ -54,11 +54,12 @@
 
 StorageQuotaClientImpl::~StorageQuotaClientImpl() {}
 
-void StorageQuotaClientImpl::requestQuota(ExecutionContext* executionContext,
+void StorageQuotaClientImpl::requestQuota(ScriptState* scriptState,
                                           WebStorageQuotaType storageType,
                                           unsigned long long newQuotaInBytes,
                                           StorageQuotaCallback* successCallback,
                                           StorageErrorCallback* errorCallback) {
+  ExecutionContext* executionContext = scriptState->getExecutionContext();
   DCHECK(executionContext);
 
   if (executionContext->isDocument()) {
diff --git a/third_party/WebKit/Source/web/StorageQuotaClientImpl.h b/third_party/WebKit/Source/web/StorageQuotaClientImpl.h
index dde0783..7537cf7 100644
--- a/third_party/WebKit/Source/web/StorageQuotaClientImpl.h
+++ b/third_party/WebKit/Source/web/StorageQuotaClientImpl.h
@@ -48,7 +48,7 @@
 
   ~StorageQuotaClientImpl() override;
 
-  void requestQuota(ExecutionContext*,
+  void requestQuota(ScriptState*,
                     WebStorageQuotaType,
                     unsigned long long newQuotaInBytes,
                     StorageQuotaCallback*,
diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml
index 26765d7..e14b164 100644
--- a/tools/metrics/histograms/histograms.xml
+++ b/tools/metrics/histograms/histograms.xml
@@ -90203,6 +90203,10 @@
   <int value="1790" label="V8MediaSession_PlaybackState_AttributeGetter"/>
   <int value="1791" label="V8MediaSession_PlaybackState_AttributeSetter"/>
   <int value="1792" label="V8MediaSession_SetActionHandler_Method"/>
+  <int value="1793" label="WebNFCPush"/>
+  <int value="1794" label="WebNFCCancelPush"/>
+  <int value="1795" label="WebNFCWatch"/>
+  <int value="1796" label="WebNFCCancelWatch"/>
 </enum>
 
 <enum name="FetchRequestMode" type="int">
diff --git a/ui/compositor/test/in_process_context_factory.cc b/ui/compositor/test/in_process_context_factory.cc
index ff90047a..0a5be65e 100644
--- a/ui/compositor/test/in_process_context_factory.cc
+++ b/ui/compositor/test/in_process_context_factory.cc
@@ -52,9 +52,11 @@
 // GL surface.
 class DirectOutputSurface : public cc::OutputSurface {
  public:
-  DirectOutputSurface(scoped_refptr<InProcessContextProvider> context_provider)
-      : cc::OutputSurface(std::move(context_provider)),
-        weak_ptr_factory_(this) {}
+  explicit DirectOutputSurface(
+      scoped_refptr<InProcessContextProvider> context_provider)
+      : cc::OutputSurface(context_provider), weak_ptr_factory_(this) {
+    capabilities_.flipped_output_surface = true;
+  }
 
   ~DirectOutputSurface() override {}
 
@@ -221,6 +223,8 @@
       shared_worker_context_provider_, &gpu_memory_buffer_manager_,
       &shared_bitmap_manager_);
   compositor->SetCompositorFrameSink(std::move(compositor_frame_sink));
+
+  data->display->Resize(compositor->size());
 }
 
 std::unique_ptr<Reflector> InProcessContextFactory::CreateReflector(
diff --git a/ui/login/account_picker/user_pod_row.css b/ui/login/account_picker/user_pod_row.css
index 7ef24e11..0dff606 100644
--- a/ui/login/account_picker/user_pod_row.css
+++ b/ui/login/account_picker/user_pod_row.css
@@ -229,6 +229,10 @@
   display: none;
 }
 
+.pod[is-active-directory] .reauth-warning {
+  display: none;
+}
+
 .pod[auth-type='offlinePassword'].focused .password-entry-container,
 .pod[auth-type='forceOfflinePassword'].focused .password-entry-container {
   display: flex;
diff --git a/ui/login/account_picker/user_pod_row.js b/ui/login/account_picker/user_pod_row.js
index 37746d0..cf09257 100644
--- a/ui/login/account_picker/user_pod_row.js
+++ b/ui/login/account_picker/user_pod_row.js
@@ -780,6 +780,9 @@
           AUTH_TYPE.OFFLINE_PASSWORD;
       this.setAuthType(initialAuthType, null);
 
+      if (this.user.isActiveDirectory)
+        this.setAttribute('is-active-directory', '');
+
       this.userClickAuthAllowed_ = false;
 
       // Lazy load the assets needed for the polymer submit button.
diff --git a/ui/views/layout/layout_constants.h b/ui/views/layout/layout_constants.h
index 41060ef..798a440 100644
--- a/ui/views/layout/layout_constants.h
+++ b/ui/views/layout/layout_constants.h
@@ -15,70 +15,70 @@
 namespace views {
 
 // Left or right margin.
-const int kPanelHorizMargin = 13;
+constexpr int kPanelHorizMargin = 13;
 
 // Top or bottom margin.
-const int kPanelVertMargin = 13;
+constexpr int kPanelVertMargin = 13;
 
 // When several controls are aligned vertically, the baseline should be spaced
 // by the following number of pixels.
-const int kPanelVerticalSpacing = 32;
+constexpr int kPanelVerticalSpacing = 32;
 
 // Vertical spacing between sub UI.
-const int kPanelSubVerticalSpacing = 24;
+constexpr int kPanelSubVerticalSpacing = 24;
 
 // Vertical spacing between a label and some control.
-const int kLabelToControlVerticalSpacing = 8;
+constexpr int kLabelToControlVerticalSpacing = 8;
 
 // Small horizontal spacing between controls that are logically related.
-const int kRelatedControlSmallHorizontalSpacing = 8;
+constexpr int kRelatedControlSmallHorizontalSpacing = 8;
 
 // Horizontal spacing between controls that are logically related.
-const int kRelatedControlHorizontalSpacing = 8;
+constexpr int kRelatedControlHorizontalSpacing = 8;
 
 // Vertical spacing between controls that are logically related.
-const int kRelatedControlVerticalSpacing = 8;
+constexpr int kRelatedControlVerticalSpacing = 8;
 
 // Small vertical spacing between controls that are logically related.
-const int kRelatedControlSmallVerticalSpacing = 4;
+constexpr int kRelatedControlSmallVerticalSpacing = 4;
 
 // Horizontal spacing between controls that are logically unrelated.
-const int kUnrelatedControlHorizontalSpacing = 12;
+constexpr int kUnrelatedControlHorizontalSpacing = 12;
 
 // Larger horizontal spacing between unrelated controls.
-const int kUnrelatedControlLargeHorizontalSpacing = 20;
+constexpr int kUnrelatedControlLargeHorizontalSpacing = 20;
 
 // Vertical spacing between controls that are logically unrelated.
-const int kUnrelatedControlVerticalSpacing = 20;
+constexpr int kUnrelatedControlVerticalSpacing = 20;
 
 // Larger vertical spacing between unrelated controls.
-const int kUnrelatedControlLargeVerticalSpacing = 30;
+constexpr int kUnrelatedControlLargeVerticalSpacing = 30;
 
 // Vertical spacing between the edge of the window and the
 // top or bottom of a button.
-const int kButtonVEdgeMargin = 9;
+constexpr int kButtonVEdgeMargin = 9;
 
 // Horizontal spacing between the edge of the window and the
 // left or right of a button.
-const int kButtonHEdgeMargin = 13;
+constexpr int kButtonHEdgeMargin = 13;
 
 // Vertical spacing between the edge of the window and the
 // top or bottom of a button (when using new style dialogs).
-const int kButtonVEdgeMarginNew = 20;
+constexpr int kButtonVEdgeMarginNew = 20;
 
 // Horizontal spacing between the edge of the window and the
 // left or right of a button (when using new style dialogs).
-const int kButtonHEdgeMarginNew = 20;
+constexpr int kButtonHEdgeMarginNew = 20;
 
 // Horizontal spacing between buttons that are logically related.
-const int kRelatedButtonHSpacing = 6;
+constexpr int kRelatedButtonHSpacing = 6;
 
 // Indent of checkboxes relative to related text.
-const int kCheckboxIndent = 10;
+constexpr int kCheckboxIndent = 10;
 
 // Horizontal spacing between the end of an item (i.e. an icon or a checkbox)
 // and the start of its corresponding text.
-const int kItemLabelSpacing = 10;
+constexpr int kItemLabelSpacing = 10;
 
 }  // namespace views